Skip to content

Commit ccb9c57

Browse files
jaelliojaellio
committed
Reconfigures demo so istio install is not expected to fail.
Created ClusterSPIFFEID before install istio. Previously install would fail because the ingress gateway wasn't registered/ Signed-off-by: jaellio <[email protected]>
1 parent 4da7716 commit ccb9c57

File tree

4 files changed

+236
-71
lines changed

4 files changed

+236
-71
lines changed

‎.spelling‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -489,6 +489,7 @@ Idit
489489
ILBs
490490
incentivized
491491
Incrementality
492+
initContainer
492493
initializer
493494
initializers
494495
injector

‎content/en/docs/ops/integrations/spire/automatic_registration_test.sh‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,30 +19,22 @@ set -e
1919
set -u
2020
set -o pipefail
2121

22+
# @setup profile=none
23+
2224
# Install SPIRE configured with k8s Controller Manager
2325
snip_install_spire_with_controller_manager
2426
_wait_for_daemonset spire spire-agent
2527
_wait_for_deployment spire spire-server
2628

29+
# Create ClusterSPIFFEID
30+
snip_create_clusterspiffeid
31+
2732
# Install Istio
28-
# @setup profile=none
2933
set +u # Do not exit when value is unset. CHECK_FILE in the IstioOperator might be unset
30-
snip_define_istio_operator
31-
if ! istioctl install --set tag="$TAG" --set hub="$HUB" --skip-confirmation -f ./istio.yaml
32-
then
33-
echo "Deployment istio-ingressgateway is not ready as expected"
34-
else
35-
echo "Istio install succeeded, expected istio-ingressgateway to not be ready"
36-
return 1
37-
fi
34+
snip_define_istio_operator_for_auto_registration
35+
snip_apply_istio_operator_configuration
3836
set -u # Exit on unset value
3937
_wait_for_deployment istio-system istiod
40-
41-
# Create ClusterSPIFFEID
42-
snip_create_clusterspiffeid
43-
44-
# Add registration label to ingress-gateway
45-
snip_label_ingressgateway
4638
_wait_for_deployment istio-system istio-ingressgateway
4739

4840
# Deploy sleep application with registration label

‎content/en/docs/ops/integrations/spire/index.md‎

Lines changed: 141 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -68,14 +68,36 @@ Istio will become the Envoy SDS listener if the socket is not created by SPIRE b
6868

6969
## Install Istio
7070

71-
1. [Download Istio release 1.14+](/docs/setup/getting-started/#download).
71+
### Option 1: Configuration for Workload Registration with the SPIRE Controller Manager
7272

73-
1. After [deploying SPIRE](#install-spire) into your environment, and verifying that all deployments are in `Ready` state,
74-
install Istio with custom patches for the Ingress-gateway as well as for istio-proxy.
73+
By deploying [SPIRE Controller Manager](https://github.com/spiffe/spire-controller-manager)
74+
along with a SPIRE Server, new entries can be automatically registered for each new pod that matches the selector defined in a [ClusterSPIFFEID](https://github.com/spiffe/spire-controller-manager/blob/main/docs/clusterspiffeid-crd.md) custom resource.
7575

76-
Create Istio configuration:
76+
A ClusterSPIFFEID must be applied prior to installing Istio in order for the Ingress-gateway to obtain its certificates. Additionally,the Ingress-gateway pod must be configured to match the selector defined in the ClusterSPIFFEID. If a registration entry for the Ingress Gateway workload was not automatically created during install, the workload would not reach a `Ready` state and installation would fail.
77+
78+
1. Create example ClusterSPIFFEID:
79+
80+
{{< text syntax=bash snip_id=create_clusterspiffeid >}}
81+
$ kubectl apply -f - <<EOF
82+
apiVersion: spire.spiffe.io/v1alpha1
83+
kind: ClusterSPIFFEID
84+
metadata:
85+
name: example
86+
spec:
87+
spiffeIDTemplate: "spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"
88+
podSelector:
89+
matchLabels:
90+
spiffe.io/spire-managed-identity: "true"
91+
EOF
92+
{{< /text >}}
7793

78-
{{< text syntax=bash snip_id=define_istio_operator >}}
94+
The example ClusterSPIFFEID enables automatic workload registration for all workloads with the `spiffe.io/spire-managed-identity: "true"` label. For pods with this label, the values specified in the `spiffeIDTemplate` will be extracted to form the SPIFFE ID.
95+
96+
1. [Download Istio release 1.14+](/docs/setup/getting-started/#download).
97+
98+
1. Create the Istio configuration with custom patches for the Ingress-gateway and istio-proxy. The Ingress Gateway component includes the `spiffe.io/spire-managed-identity: "true"` label.
99+
100+
{{< text syntax=bash snip_id=define_istio_operator_for_auto_registration >}}
79101
$ cat <<EOF > ./istio.yaml
80102
apiVersion: install.istio.io/v1alpha1
81103
kind: IstioOperator
@@ -109,6 +131,7 @@ Istio will become the Envoy SDS listener if the socket is not created by SPIRE b
109131
enabled: true
110132
label:
111133
istio: ingressgateway
134+
spiffe.io/spire-managed-identity: "true"
112135
k8s:
113136
overlays:
114137
- apiVersion: apps/v1
@@ -150,63 +173,140 @@ Istio will become the Envoy SDS listener if the socket is not created by SPIRE b
150173
EOF
151174
{{< /text >}}
152175

153-
Apply the configuration:
176+
1. Apply the configuration:
154177

155-
{{< text bash >}}
178+
{{< text syntax=bash snip_id=apply_istio_operator_configuration >}}
156179
$ istioctl install --skip-confirmation -f ./istio.yaml
157180
{{< /text >}}
158181

159-
This will share the `spiffe-csi-driver` with the Ingress Gateway and the sidecars that are going to be injected on workload pods,
160-
granting them access to the SPIRE Agent's UNIX Domain Socket.
182+
1. Check Ingress-gateway pod state:
161183

162-
This will also add an initContainer to the gateway that will wait for SPIRE to create the UNIX Domain Socket before starting the istio-proxy. If the SPIRE agent is not ready or has not been properly configured with the same socket path, the Ingress Gateway initContainer will wait forever.
163-
164-
Check Ingress-gateway pod state:
165-
166-
{{< text syntax=bash snip_id=none >}}
167-
$ kubectl get pods -n istio-system
168-
NAME READY STATUS RESTARTS AGE
169-
istio-ingressgateway-5b45864fd4-lgrxs 0/1 Running 0 17s
170-
istiod-989f54d9c-sg7sn 1/1 Running 0 23s
171-
{{< /text >}}
184+
{{< text syntax=bash snip_id=none >}}
185+
$ kubectl get pods -n istio-system
186+
NAME READY STATUS RESTARTS AGE
187+
istio-ingressgateway-5b45864fd4-lgrxs 1/1 Running 0 17s
188+
istiod-989f54d9c-sg7sn 1/1 Running 0 23s
189+
{{< /text >}}
172190

173-
The Ingress-gateway pod and data plane containers will only reach `Ready` if a corresponding registration entry is created for them on the SPIRE Server. Then,
174-
Envoy will be able to fetch cryptographic identities from SPIRE.
175-
See [Register workloads](#register-workloads) to register entries for services in your mesh.
191+
The Ingress-gateway pod is `Ready` since the corresponding registration entry is automatically created for it on the SPIRE Server. Envoy is able to fetch cryptographic identities from SPIRE.
176192

177-
## Register workloads
193+
Note that `SPIRE Controller Manager` is used in the [quick start](#option-1:-quick-start) section.
178194

179-
This section describes the options available for registering workloads in a SPIRE Server.
195+
### Option 2: Configuration for Manual Workload Registration with SPIRE
180196

181-
### Option 1: Registration using the SPIRE Controller Manager
197+
1. [Download Istio release 1.14+](/docs/setup/getting-started/#download).
182198

183-
By deploying [SPIRE Controller Manager](https://github.com/spiffe/spire-controller-manager)
184-
along with a SPIRE Server, new entries can be automatically registered for each new pod that matches the selector defined in a [ClusterSPIFFEID](https://github.com/spiffe/spire-controller-manager/blob/main/docs/clusterspiffeid-crd.md) custom resource.
199+
1. After [deploying SPIRE](#install-spire) into your environment, and verifying that all deployments are in `Ready` state, install Istio with custom patches for the Ingress-gateway as well as for istio-proxy.
185200

186-
1. Create an example ClusterSPIFFEID:
201+
Create Istio configuration:
187202

188-
{{< text syntax=bash snip_id=create_clusterspiffeid >}}
189-
$ kubectl apply -f - <<EOF
190-
apiVersion: spire.spiffe.io/v1alpha1
191-
kind: ClusterSPIFFEID
203+
{{< text syntax=bash snip_id=define_istio_operator_for_manual_registration >}}
204+
$ cat <<EOF > ./istio.yaml
205+
apiVersion: install.istio.io/v1alpha1
206+
kind: IstioOperator
192207
metadata:
193-
name: example
208+
namespace: istio-system
194209
spec:
195-
spiffeIDTemplate: "spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"
196-
podSelector:
197-
matchLabels:
198-
spiffe.io/spire-managed-identity: "true"
210+
profile: default
211+
meshConfig:
212+
trustDomain: example.org
213+
values:
214+
global:
215+
# This is used to customize the sidecar template
216+
sidecarInjectorWebhook:
217+
templates:
218+
spire: |
219+
spec:
220+
containers:
221+
- name: istio-proxy
222+
volumeMounts:
223+
- name: workload-socket
224+
mountPath: /run/secrets/workload-spiffe-uds
225+
readOnly: true
226+
volumes:
227+
- name: workload-socket
228+
csi:
229+
driver: "csi.spiffe.io"
230+
readOnly: true
231+
components:
232+
ingressGateways:
233+
- name: istio-ingressgateway
234+
enabled: true
235+
label:
236+
istio: ingressgateway
237+
k8s:
238+
overlays:
239+
- apiVersion: apps/v1
240+
kind: Deployment
241+
name: istio-ingressgateway
242+
patches:
243+
- path: spec.template.spec.volumes.[name:workload-socket]
244+
value:
245+
name: workload-socket
246+
csi:
247+
driver: "csi.spiffe.io"
248+
readOnly: true
249+
- path: spec.template.spec.containers.[name:istio-proxy].volumeMounts.[name:workload-socket]
250+
value:
251+
name: workload-socket
252+
mountPath: "/run/secrets/workload-spiffe-uds"
253+
readOnly: true
254+
- path: spec.template.spec.initContainers
255+
value:
256+
- name: wait-for-spire-socket
257+
image: busybox:1.28
258+
volumeMounts:
259+
- name: workload-socket
260+
mountPath: /run/secrets/workload-spiffe-uds
261+
readOnly: true
262+
env:
263+
- name: CHECK_FILE
264+
value: /run/secrets/workload-spiffe-uds/socket
265+
command:
266+
- sh
267+
- "-c"
268+
- |-
269+
echo "$(date -Iseconds)" Waiting for: ${CHECK_FILE}
270+
while [[ ! -e ${CHECK_FILE} ]] ; do
271+
echo "$(date -Iseconds)" File does not exist: ${CHECK_FILE}
272+
sleep 15
273+
done
274+
ls -l ${CHECK_FILE}
199275
EOF
200276
{{< /text >}}
201277

202-
The example ClusterSPIFFEID enables automatic workload registration for all workloads with the `spiffe.io/spire-managed-identity: "true"` label. For pods with this label, the values specified in the `spiffeIDTemplate` will be extracted to form the SPIFFE ID.
278+
1. Apply the configuration:
279+
280+
{{< text syntax=bash snip_id=none >}}
281+
$ istioctl install --skip-confirmation -f ./istio.yaml
282+
{{< /text >}}
203283

204-
1. Add the `spiffe.io/spire-managed-identity` label to the Ingress-gateway deployment to register the workload:
284+
1. Check Ingress-gateway pod state:
205285

206-
{{< text syntax=bash snip_id=label_ingressgateway >}}
207-
$ kubectl patch deployment istio-ingressgateway -n istio-system -p '{"spec":{"template":{"metadata":{"labels":{"spiffe.io/spire-managed-identity": "true"}}}}}'
286+
{{< text syntax=bash snip_id=none >}}
287+
$ kubectl get pods -n istio-system
288+
NAME READY STATUS RESTARTS AGE
289+
istio-ingressgateway-5b45864fd4-lgrxs 0/1 Running 0 20s
290+
istiod-989f54d9c-sg7sn 1/1 Running 0 25s
208291
{{< /text >}}
209292

293+
The Ingress-gateway pod and data plane containers will only reach `Ready` if a corresponding registration entry is created for them on the SPIRE Server. Then,
294+
Envoy will be able to fetch cryptographic identities from SPIRE.
295+
See [Register workloads](#register-workloads) to register entries for services in your mesh.
296+
297+
The Istio configuration shares the `spiffe-csi-driver` with the Ingress Gateway and the sidecars that are going to be injected on workload pods,
298+
granting them access to the SPIRE Agent's UNIX Domain Socket.
299+
300+
This configuration also adds an initContainer to the gateway that will wait for SPIRE to create the UNIX Domain Socket before starting the istio-proxy. If the SPIRE agent is not ready or has not been properly configured with the same socket path, the Ingress Gateway initContainer will wait forever.
301+
302+
## Register workloads
303+
304+
This section describes the options available for registering workloads in a SPIRE Server.
305+
306+
### Option 1: Registration using the SPIRE Controller Manager
307+
308+
New entries will be automatically registered for each new pod that matches the selector defined in a [ClusterSPIFFEID](https://github.com/spiffe/spire-controller-manager/blob/main/docs/clusterspiffeid-crd.md) custom resource. See [Configuration for Workload Registration with the SPIRE Controller Manager](#option-1:-configuration-for-workload-registration-with-the-spire-controller-manager) for the example ClusterSPIFFEID configuration.
309+
210310
1. Deploy an example workload:
211311

212312
{{< text syntax=bash snip_id=apply_sleep >}}

0 commit comments

Comments
 (0)